opnocnstbg67sdfsd[.]chayce1[.]workers[.]dev

Analysis of opnocnstbg67sdfsd.chayce1.workers.dev shows a newly registered domain (creation date February 21, 2026) that resolves to IP 142.250.186.132, an address owned by AS15169 Google LLC in the United States. The server presents a TLS certificate issued by Google Trust Services, and the HTTPS service advertises Google Web Server, HSTS, and HTTP/3. HTTP responses return a 302 redirect, and the page title reported by crawlers is "Google". The domain is hosted behind Cloudflare infrastructure and is listed on a single security blocklist; PhishDestroy has explicitly blocked it. VirusTotal scans indicate that one of ninety‑three security vendors flagged the domain, while Gridinsoft assigns a trust score of zero out of one hundred. Intelligence tags the site as a credential‑phishing campaign that impersonates Google. Current evidence confirms the domain’s intent to mimic Google branding, but the exact phishing payload or landing page content has not been observed. Defenders should block the domain at network perimeter, monitor DNS queries for the host, and add the address to internal blacklists. Continuous re‑scanning is advised, as additional detections may emerge as the campaign evolves.